Anthropic-Credited-CVEs — Updated!

ANTHROPIC CVE TRACKER Overview Tracking vulnerabilities that credit the Anthropic research team and are possibly discovered by Project Glasswing. CURRENT CVE COUNT: 301 Fixed Anthropic Findings w/o CVE: 128 Findings Withdrawn by Anthropic: 243 Distributions | ---|--- Anthropic Research Tracking...

ict279-cve-2025-54793

ict279-cve-2025-54793 Group project — CVE-2025-54793 detection & mitigation Bhuvanesh, Shiva, Emma...

CVE-2026-75033: Authorization Bypass Through User-Controlled Key

A flaw was found in Rancher Manager. Project Secrets were propagated into a namespace based only on its field.cattle.io/projectId annotation, without verifying that the referenced project belonged to the same downstream cluster. A user able to create namespaces on one cluster could set the...

PT-2026-85005

n8n versions before 2.36.2 contain a missing per-project authorization vulnerability in the Insights API routes that allows authenticated users with insights scopes to access workflow names and execution statistics across projects. Attackers can supply arbitrary projectId parameters to retrieve...

PT-2026-85375

Name of the Vulnerable Software and Affected Versions Ignition versions prior to 8.1.54 Description An authenticated user can create projects due to a blank default configuration in the Gateway 'Create Project Roles' setting. This flaw allows attackers to escalate privileges to project creators a...

CVE-2026-18718 — Updated!

Advisory: GHSA-pcfh-853f-q3gh · Severity: High CVSS 7.5 · Affected: Ghidra ≤ 12.1.2 · Fixed: c03a70d Ghidra 12.1.3 Opening someone else's Ghidra project was enough to execute their code. Ghidra 12.1.2 stores analyzer options inside the program database , and one of those options is a filesystem...

EUVD-2026-58507

OpenChoreo: Cross-project command execution and wirelog view access via OpenChoreo openchoreo-api exec and wirelogs endpoints...

OpenChoreo: Cross-project command execution and wirelog view access via OpenChoreo openchoreo-api exec and wirelogs endpoints

Summary The OpenChoreo API server openchoreo-api authorized requests to its exec and wirelogs endpoints against the project supplied by the caller in the request, rather than against the project that actually owns the target component. The target component was resolved by name only, and the...

GHSA-52GF-6RPQ-FGMX OpenChoreo: Cross-project command execution and wirelog view access via OpenChoreo openchoreo-api exec and wirelogs endpoints

Summary The OpenChoreo API server openchoreo-api authorized requests to its exec and wirelogs endpoints against the project supplied by the caller in the request, rather than against the project that actually owns the target component. The target component was resolved by name only, and the...

GO-2026-6311 Vikunja has a project duplication bypasses write-permission check on the target parent project in code.vikunja.io/api

Vikunja has a project duplication bypasses write-permission check on the target parent project in code.vikunja.io/api. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive...

GO-2026-6306 Vikunja has an incomplete fix for CVE-2026-35595: Write-only user can detach shared project from parent hierarchy via parent_project_id=0 in code.vikunja.io/api

Vikunja has an incomplete fix for CVE-2026-35595: Write-only user can detach shared project from parent hierarchy via parentprojectid=0 in code.vikunja.io/api. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module...

GO-2026-6319 Incus has a project restriction bypass in instance copy across projects in github.com/lxc/incus

Incus has a project restriction bypass in instance copy across projects in github.com/lxc/incus...

CVE-2026-45730

Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. Prior to version 1.16.0, there is a vulnerability in Nuclio Dashboard's project management API, allowing any authenticated user without membership in the target project to bypass OPA authorization checks on write paths P...

CVE-2026-45730 Nuclio: Missing authorization on project write paths allows any authenticated user to modify or delete any project

Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. Prior to version 1.16.0, there is a vulnerability in Nuclio Dashboard's project management API, allowing any authenticated user without membership in the target project to bypass OPA authorization checks on write paths P...

CVE-2026-45730 Nuclio: Missing authorization on project write paths allows any authenticated user to modify or delete any project

Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. Prior to version 1.16.0, there is a vulnerability in Nuclio Dashboard's project management API, allowing any authenticated user without membership in the target project to bypass OPA authorization checks on write paths P...

EUVD-2026-70212

Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. Prior to version 1.16.0, there is a vulnerability in Nuclio Dashboard's project management API, allowing any authenticated user without membership in the target project to bypass OPA authorization checks on write paths P...

CVE-2026-45730 Nuclio: Missing authorization on project write paths allows any authenticated user to modify or delete any project

Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. Prior to version 1.16.0, there is a vulnerability in Nuclio Dashboard's project management API, allowing any authenticated user without membership in the target project to bypass OPA authorization checks on write paths P...

CVE-2026-45730

Nuclio is a serverless framework for real-time events and data processing. The vulnerability exists in the Nuclio Dashboard's project management API on write paths (PUT /api/projects/{id}, DELETE /api/projects). The root cause is that these endpoints construct PermissionOptions without setting Me...

CVE-2024-7956

A vulnerability exists in the affected products that allows a threat actor to gain access to user’s projects. To exploit this vulnerability the threat actor must have basic user privileges. If exploited, the threat actor can modify and delete the project...

CVE-2024-7956

CVE-2024-7956 is an Incorrect Authorization (CWE-863) vulnerability in Rockwell Automation DataMosaix Private Cloud , versions 7.07 and prior . A threat actor with basic user privileges can gain unauthorized access to other users' projects and modify or delete them. The CVSS v3.1 base score is 8....